General

  • Target
    phish_alert_sp2_2.0.0.0 (3).eml
  • Size 18KB
  • Sample261027-lbbqaadb57
  • SHA256 25f705a0d250ce6d5ad4f559a7864a3c4c6becb100610039fd7220d1047fffe8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • phish_alert_sp2_2.0.0.0 (3).eml
    .eml 18KB
  • email-html-1.txt
    .html 8KB

phish_alert_sp2_2.0.0.0 (3).eml

  • SHA256 25f705a0d250ce6d5ad4f559a7864a3c4c6becb100610039fd7220d1047fffe8
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

bounces+35586458-0d02-ulla.soerensen=nktphotonics.com@mkt.narwalsistemas.com.br

Date

Sun, 25 Oct 2026 11:45:49 +0000

Subject

=?UTF-8?B?QW5pdmVyc2FyaWFudGUgZG8gZGlhOiBUYWluYW4gQ2FyZG9zbyBD?= =?UTF-8?B?cnV6?=

Content-Type

multipart/mixed; boundary="----sinikael-?=_1-17929392258460.2158134868057061"

Received

from DU2PR02MB7773.eurprd02.prod.outlook.com (2603:10a6:10:2e4::20) by DU2PR02MB10448.eurprd02.prod.outlook.com with HTTPS; Sun, 25 Oct 2026 11:45:53 +0000

from PAZP264CA0182.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:236::15) by DU2PR02MB7773.eurprd02.prod.outlook.com (2603:10a6:10:2e4::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Sun, 25 Oct 2026 11:45:51 +0000

from MI3PEPF00008552.eurprd05.prod.outlook.com (2603:10a6:102:236:cafe::2c) by PAZP264CA0182.outlook.office365.com (2603:10a6:102:236::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Sun, 25 Oct 2026 11:45:51 +0000

from wrqvrhhr.outbound-mail.sendgrid.net (149.72.80.5) by MI3PEPF00008552.mail.protection.outlook.com (10.167.240.6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Sun, 25 Oct 2026 11:45:50 +0000

by recvd-5896495599-zrdq5 with SMTP id recvd-5896495599-zrdq5-1-6ADDEBE6-3A 2026-10-25 11:45:42.682507849 +0000 UTC m=+2227523.708339352

from MzU1ODY0NTg (unknown) by geopod-ismtpd-98 (SG) with HTTP id _45DXTa-Q2W1JmGgkexGhQ Sun, 25 Oct 2026 11:45:42.667 +0000 (UTC)

Received-Spf

Pass (protection.outlook.com: domain of mkt.narwalsistemas.com.br designates 149.72.80.5 as permitted sender) receiver=protection.outlook.com; client-ip=149.72.80.5; helo=wrqvrhhr.outbound-mail.sendgrid.net; pr=C

Message-Id

<_45DXTa-Q2W1JmGgkexGhQ@geopod-ismtpd-98>

Extracted URLs

  • file https://t.rdsv2.net/ls/click?upn=u001.EoU2-2FuEEmAsdVilzRgYvEUeMOSKPEsH3eAJIfSIBMevgUMQ1cn71NdExIOJeG38tngS2F4fY6ycrjzmwIA6GypoOFvI75wPkE5MYTINxMdK-2B-2BzR8PcuRFdzTEVz8ibeQ7HVvmyrzdZWRATS6SzJ1UCXxnSwB76hdtKfBi31mbw24ZmWKl39-2FwJ-2BMf1C6P3ry0gYtg-2FYaP76HUm7DQS0rnF0h70okN-2BFSeiJFWdkVG-2FTg-2FADkbu76w5LdxMNrS9j4rIg5t5szszVDyBSVurpN4Q-3D-3DzGft_PxkY1cRNAhrJ52NfTWb-2Feyea6ggeXAxvK08YC5uGnhmZmaqCalqiOIjRlssRiKfHFO1twR-2BlMo-2BHuS-2BA4nckMyksea9R8N-2FBVtUo39PKZLcTiTxEDn5ReIzNBhTMSradHwZtWx7Cm-2BHrCiKiMHtcR2cgl8pqWGaMcNoJWMup-2BNOCelex2vRUk2pOWsGGkFjp2LC1PtjTdPHsJuo-2BAKUyqIg5w5HK4lKnPdEFNBTR-2FCfOfUG3wD8ej7IqXTnfkw9WaNETrzhbpwHueMtdsUXcAAghpgjBUQce-2FyX20J-2FG7N4K1Uzs-2FkVm8hf-2BR4yoBAH0WdrYUSE8guiYc0fX4BFCUpMkcD0TWWd31x8-2FQQYFepFts5sDLqlLjXuHkQY7hEbOc-2FGbYBq5Ixvib5y5hvd45oTVZRmozMRcJEkXWuFOYl2EWcmyxfr-2BIdckrGwJESJrzWJREHxHSiz-2F6hLpLqtxxdKaCiXYtijr51n2AGWPVrF5-2BzNJj6JoiuLH8Uqui-2BdTPJvgopB-2BGQ42fE6x3vq5mt-2FOnOAzYYrfhBR-2BlNcblVG-2Fo5q1P-2Bi7n98Bk863kyatjYhibRKS8RVdx1-2BxY0HO2J1ooA6JbUOXABy2ZVq-2FN793JRA6XmyhbbpsK4POTnVMU-2Bas4-2B2uZJqJBAcgz-2BoiW7KBrb3YD4XMXf6HePWfwV8uKNu06bab-2FslS1WAUGACIWrBaX0DBRRzwBa9O65xDuQ-3D-3D